1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<!-- This manual is last updated 4 March 2015 for version
3.5.2 of GnuTLS.
Copyright (C) 2001-2015 Free Software Foundation, Inc.\\
Copyright (C) 2001-2015 Nikos Mavrogiannopoulos
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A
copy of the license is included in the section entitled "GNU Free
Documentation License". -->
<!-- Created by GNU Texinfo 6.1, http://www.gnu.org/software/texinfo/ -->
<head>
<title>GnuTLS 3.5.2: False Start</title>
<meta name="description" content="GnuTLS 3.5.2: False Start">
<meta name="keywords" content="GnuTLS 3.5.2: False Start">
<meta name="resource-type" content="document">
<meta name="distribution" content="global">
<meta name="Generator" content="makeinfo">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link href="index.html#Top" rel="start" title="Top">
<link href="Function-and-Data-Index.html#Function-and-Data-Index" rel="index" title="Function and Data Index">
<link href="index.html#SEC_Contents" rel="contents" title="Table of Contents">
<link href="TLS-Extensions.html#TLS-Extensions" rel="up" title="TLS Extensions">
<link href="Application-Layer-Protocol-Negotiation-_0028ALPN_0029.html#Application-Layer-Protocol-Negotiation-_0028ALPN_0029" rel="next" title="Application Layer Protocol Negotiation (ALPN)">
<link href="SRTP.html#SRTP" rel="prev" title="SRTP">
<style type="text/css">
<!--
a.summary-letter {text-decoration: none}
blockquote.indentedblock {margin-right: 0em}
blockquote.smallindentedblock {margin-right: 0em; font-size: smaller}
blockquote.smallquotation {font-size: smaller}
div.display {margin-left: 3.2em}
div.example {margin-left: 3.2em}
div.lisp {margin-left: 3.2em}
div.smalldisplay {margin-left: 3.2em}
div.smallexample {margin-left: 3.2em}
div.smalllisp {margin-left: 3.2em}
kbd {font-style: oblique}
pre.display {font-family: inherit}
pre.format {font-family: inherit}
pre.menu-comment {font-family: serif}
pre.menu-preformatted {font-family: serif}
pre.smalldisplay {font-family: inherit; font-size: smaller}
pre.smallexample {font-size: smaller}
pre.smallformat {font-family: inherit; font-size: smaller}
pre.smalllisp {font-size: smaller}
span.nolinebreak {white-space: nowrap}
span.roman {font-family: initial; font-weight: normal}
span.sansserif {font-family: sans-serif; font-weight: normal}
ul.no-bullet {list-style: none}
body {
margin: 2%;
padding: 0 5%;
background: #ffffff;
}
h1,h2,h3,h4,h5 {
font-weight: bold;
padding: 5px 5px 5px 5px;
background-color: #c2e0ff;
color: #336699;
}
h1 {
padding: 2em 2em 2em 5%;
color: white;
background: #336699;
text-align: center;
letter-spacing: 3px;
}
h2 { text-decoration: underline; }
pre {
margin: 0 5%;
padding: 0.5em;
}
pre.example,pre.verbatim {
padding-bottom: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 1px 1px 1px 5px;
margin: 1em auto;
width: 90%;
}
div.node {
margin: 0 -5% 0 -2%;
padding: 0.5em 0.5em;
margin-top: 0.5em;
margin-bottom: 0.5em;
font-weight: bold;
}
dd, li {
padding-top: 0.1em;
padding-bottom: 0.1em;
}
div.float {
margin-bottom: 0.5em;
text-align: center;
}
table {
text-align: left;
margin-left:auto;
margin-right:auto;
border-spacing: 7px;
width: 50%;
}
th {
padding: 0;
color: #336699;
background-color: #c2e0ff;
border: solid #000000;
border-width: 0px;
margin: 1em auto;
text-align: center;
margin-left:auto;
margin-right:auto;
}
td {
padding: 0;
border: solid #000000;
background-color: #f0faff;
border-width: 0px;
margin: 1em auto;
text-align: left;
margin-left:auto;
margin-right:auto;
padding-left: 1em;
}
dl {
text-align: left;
margin-left:auto;
margin-right:auto;
width: 50%;
padding-left: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 5px 1px 1px 1px;
margin: 1em auto;
}
-->
</style>
</head>
<body lang="en">
<a name="False-Start"></a>
<div class="header">
<p>
Next: <a href="Application-Layer-Protocol-Negotiation-_0028ALPN_0029.html#Application-Layer-Protocol-Negotiation-_0028ALPN_0029" accesskey="n" rel="next">Application Layer Protocol Negotiation (ALPN)</a>, Previous: <a href="SRTP.html#SRTP" accesskey="p" rel="prev">SRTP</a>, Up: <a href="TLS-Extensions.html#TLS-Extensions" accesskey="u" rel="up">TLS Extensions</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
<hr>
<a name="False-Start-1"></a>
<h4 class="subsection">3.6.8 False Start</h4>
<a name="index-False-Start"></a>
<a name="index-TLS-False-Start"></a>
<p>The TLS protocol was extended in [<em>draft-ietf-tls-falsestart-01</em>] to allow the client
to send data to server in a single round trip. This change however operates on the borderline
of the TLS protocol security guarrantees and should be used for the cases where the reduced
latency outperforms the risk of an adversary intercepting the transferred data. In GnuTLS
applications can use the <acronym>GNUTLS_ENABLE_FALSE_START</acronym> as option to <a href="Core-TLS-API.html#gnutls_005finit">gnutls_init</a>
to request an early return of the <a href="Core-TLS-API.html#gnutls_005fhandshake">gnutls_handshake</a> function. After that early
return the application is expected to transfer any data to be piggybacked on the last handshake
message.
</p>
<p>After handshake’s early termination, the application is expected to transmit
data using <a href="Core-TLS-API.html#gnutls_005frecord_005fsend">gnutls_record_send</a>, and call <a href="Core-TLS-API.html#gnutls_005frecord_005frecv">gnutls_record_recv</a> on
any received data as soon, to ensure that handshake completes timely. That is, especially
relevant for applications which set an explicit time limit for the handshake process
via <a href="Core-TLS-API.html#gnutls_005fhandshake_005fset_005ftimeout">gnutls_handshake_set_timeout</a>.
</p>
<p>Note however, that the API ensures that the early return will not happen
if the false start requirements are not satisfied. That is, on ciphersuites which are not
whitelisted for false start or on insufficient key sizes, the handshake
process will complete properly (i.e., no early return). To verify that false start was used you
may use <a href="Core-TLS-API.html#gnutls_005fsession_005fget_005fflags">gnutls_session_get_flags</a> and check for the <acronym>GNUTLS_SFLAGS_FALSE_START</acronym>
flag. For GnuTLS the false start is whitelisted for the following
key exchange methods (see [<em>draft-ietf-tls-falsestart-01</em>] for rationale)
</p><ul>
<li> DHE
</li><li> ECDHE
</li></ul>
<p>but only when the negotiated parameters exceed <code>GNUTLS_SEC_PARAM_HIGH</code>
–see <a href="Selecting-cryptographic-key-sizes.html#tab_003akey_002dsizes">Table 6.7</a>, and when under (D)TLS 1.2 or later.
</p>
<hr>
<div class="header">
<p>
Next: <a href="Application-Layer-Protocol-Negotiation-_0028ALPN_0029.html#Application-Layer-Protocol-Negotiation-_0028ALPN_0029" accesskey="n" rel="next">Application Layer Protocol Negotiation (ALPN)</a>, Previous: <a href="SRTP.html#SRTP" accesskey="p" rel="prev">SRTP</a>, Up: <a href="TLS-Extensions.html#TLS-Extensions" accesskey="u" rel="up">TLS Extensions</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
</body>
</html>
|
